CVE-2024-3596

Summary: CVE-2024-3596 is a forgery vulnerability in RADIUS (RFC 2865) where a local attacker can modify a valid RADIUS response to another response using a chosen-prefix collision against MD5. The vulnerability is associated with FreeRADIUS and is covered in multiple advisories (ALAS/ALSA) confi...

CVE-2022-23302

CVE-2022-23302 affects Log4j 1.x JMSSink. TheDeserialization flaw allows remote code execution when an attacker can write to the Log4j configuration or when the configuration references an LDAP service the attacker controls. JMSSink can be triggered via a TopicConnectionFactoryBindingName to caus...

CVE-2022-23305

CVE-2022-23305 concerns Apache Log4j 1.x when configured with JDBCAppender: an SQL statement is built from a PatternLayout-converted value (notably %m), allowing an attacker to craft input to alter and potentially execute SQL. The issue is specific to Log4j 1.x if JDBCAppender is used; JDBCAppend...

CVE-2024-29964

Summary (CVE-2024-29964) : Brocade SANnav versions prior to 2.3.0a erroneously set file permissions, including for Docker-related files. This weakness can allow an unprivileged attacker with server access to read sensitive information from these files. Public sources consistently cite the same is...

CVE-2024-2859

CVE-2024-2859 affects Brocade SANnav OVA images. The issue stems from the default configuration: the root user login is enabled, which could allow an unauthenticated/remote attacker to access the device if root access is obtained. Public sources in the connected records confirm the vulnerability ...

CVE-2024-29966

CVE-2024-29966 affects Brocade SANnav OVA images prior to 2.3.1 and 2.3.0a where hard-coded credentials are documented as the appliance root password. This could allow an unauthenticated attacker full access to the SANnav appliance. Root cause: credentials documented in install/maintenance materi...

CVE-2024-29963

CVE-2024-29963 affects Brocade SANnav OVA before v2.3.1 and v2.3.0a, where hardcoded TLS keys are used by Docker. Root cause: embedded TLS keys in the appliance enable potential MITM exposure if Docker TLS traffic is reachable; SANnav reportedly does not access remote Docker registries. Impact: c...

CVE-2022-43937

CVE-2022-43937 corresponds to a log file information exposure in Brocade SANnav. Connected documents confirm that sensitive fields can be recorded in debug-enabled logs when debugging is on, affecting SANnav versions prior to 2.3.0 and 2.2.2a. The entries consolidate multiple advisories across Re...

CVE-2024-29959

Summary: CVE-2024-29959 affects Brocade SANnav (standalone SAN management) prior to SANnav 2.3.1 and 2.3.0a, where the Standby node’s support save files expose encrypted Fabric OS switch passwords. The root cause is improper handling of sensitive data in the standby save, leading to password leak...

CVE-2024-4159

Summary: Brocade SANnav (v2.3.0a and earlier) is vulnerable due to lack of protection on ports 2377/TCP and 7946/TCP, allowing an unauthenticated attacker to sniff SANnav Docker information. The issue stems from missing protection mechanisms in the affected SANnav deployment. Affected product/ver...

CVE-2024-29965

CVE-2024-29965 affects Brocade SANnav versions prior to 2.3.1 and 2.3.0a. The issue allows backups created via the web UI or SSH to be world-readable, enabling a local attacker to recover backup files, restore them on a malicious appliance, and obtain the passwords for all switches. Documents con...

CVE-2024-29967

CVE-2024-29967 affects Brocade SANnav prior to v2.31 and v2.3.0a, where Docker instances inside the appliance have insecure mount points that allow a sudo-privileged host user to read and write sensitive files. The vulnerability arises from how Docker containers within the SANnav appliance mount ...

CVE-2019-16206

CVE-2019-16206 affects Broadcom/Brocade SANnav prior to version 2.0. The authentication mechanism logs plaintext account credentials at the trace and debug levels, enabling a local authenticated attacker to access sensitive information via log files. This information-disclosure flaw is consistent...

CVE-2024-29960

CVE-2024-29960 involves Brocade SANnav: in SANnav VMs based on the official OVA images, SSH keys are identical in every installation for versions before 2.3.1 and 2.3.0a, enabling MITM on SSH. This allows an attacker to decrypt and compromise SSH traffic to the SANnav appliance. The issue is tied...

CVE-2024-4173

CVE-2024-4173 affects Brocade SANnav. Public docs show that Kafka is exposed on the WAN interface and, in SANnav versions prior to 2.2.0, the Kafka process runs as root with default credentials, enabling unauthenticated access that could lead to DOS among other attacks. The issue is documented by...

CVE-2022-33187

The CVE-2022-33187 issue affects Brocade SANnav before v2.2.1. Root cause: usernames and encoded passwords are logged in debug-enabled logs, allowing an admin with privileges to read sensitive information. Impact details consistently mention potential exposure of credentials within logs. The prac...

CVE-2019-16207

CVE-2019-16207 affects Broadcom/ Brocade SANnav prior to version 2.0. The issue is a hard-coded password in SANnav, enabling local authenticated attackers to access the back-end database and escalate privileges. Connected sources confirm the vulnerability exists in SANnav versions before 2.0 and ...

CVE-2024-29952

CVE-2024-29952 affects Brocade SANnav prior to v2.3.1 and v2.3.0a. An authenticated user can exploit command-variable manipulation to cause logs to disclose Auth, Priv, and SSL key store passwords in plaintext. The vulnerability has a local attack vector with low attack complexity and no user int...

CVE-2022-43936

CVE-2022-43936 affects Brocade SANnav before v2.2.2. The root cause is that enabling debugging causes Fabric OS switch passwords to be logged, risking disclosure of sensitive credentials. Impact is limited to password exposure via logs; no other compromises described. Remediation: upgrade to v2.2...

CVE-2022-43933

CVE-2022-43933 affects Brocade SANnav prior to version 2.2.2. The vulnerability is an information exposure through log files: the supportsave/log data may contain configuration secrets such as usernames, passwords, and secret keys. Affects SANnav deployments where a log file generated by an admin...

CVE-2022-43934

The CVE-2022-43934 entry concerns Brocade SANnav before version 2.2.2 that supports weak key exchange algorithms. Affected component: Brocade SANnav (Fibre Channel management platform). Impact as stated: weak key exchange on specific ports (24, 6514, 18023, 19094, 19095) which could expose confid...

CVE-2022-43935

The CVE-2022-43935 entry describes an information exposure in Brocade SANnav prior to version 2.2.2, where Fabric OS switch passwords and authorization IDs are printed in the embedded MLS DB file. This local-attack surface could lead to disclosure of sensitive credentials (confidentiality impact ...

CVE-2024-4161

CVE-2024-4161 affects Brocade SANnav prior to version 2.3.0, where syslog traffic is transmitted in clear text. This enables an unauthenticated, remote attacker to capture sensitive information via the syslog channel. The issue is documented across multiple sources (NVD/NVD, Red Hat, Broadcom adv...

CVE-2025-1053

CVE-2025-1053 affects Brocade SANnav. Under certain error conditions during installation or upgrade, the encryption key can be written to and retrieved from a SANnav supportsave. An attacker with privileged access to the SANnav database could use that key to obtain passwords used by SANnav. Conne...

CVE-2024-29955

Summary (CVE-2024-29955): Brocade SANnav before v2.3.1 and v2.3.0a is affected by a vulnerability where a privileged user can print the SANnav encrypted key in PostgreSQL startup logs due to insufficient protection of registration data in the PostgreSQL component. This could allow attackers with ...

CVE-2024-2860

The CVE-2024-2860 entry concerns Brocade SANnav. The affected software is SANnav, with the vulnerable component being the PostgreSQL implementation prior to version 2.3.0a. The root cause is an incorrect local authentication flaw that lets an attacker who can access the VM running SANnav read dat...

CVE-2024-29956

Summary: CVE-2024-29956 affects Brocade SANnav prior to v2.3.1 and v2.3.0a, where the Brocade SANnav password is printed in clear text in supportsave logs when a user schedules a switch Supportsave. This disclosure comes from multiple sources in the Connected documents, including the NVD/NVD-deri...

CVE-2024-29957

CVE-2024-29957 affects Brocade SANnav prior to v2.3.1 and v2.3.0a when in Disaster Recovery mode, where the encryption key is stored in DR log files. This exposes a risk that an attacker could obtain the encryption key via read access to DR logs. The issue is tied to SANnav software on Brocade de...

CVE-2024-10404

CVE-2024-10404 affects Brocade SANnav (before 2.3.1b). It discloses that CalInvocationHandler logs sensitive information in clear text, allowing an authenticated, local attacker with admin privileges to view sensitive data (including passwords such as AuthSecret and PrivSecret) after a supportsav...

CVE-2024-29969

CVE-2024-29969 : In Brocade SANnav, upgrading from v2.2.2 to v2.3.0 introduces TLS/SSL weak message authentication code ciphers by default on port 18082. The available connected sources confirm the upgrade-related change and the affected port, but do not provide exploitable details or remediation...

CVE-2024-29961

Brocade SANnav prior to v2.3.1 and v2.3.0a contains a vulnerability where the SANnav service periodically pings gridgain.com to check for updates. This unauthenticated, remote behavior could enable a supply-chain attack against affected SANnav appliances. Remediation: upgrade to SANnav 2.3.1 or l...

CVE-2024-29962

CVE-2024-29962 involves Brocade SANnav OVA images. The connected documents confirm that SANnav OVA before v2.3.1 and v2.3.0a have an insecure file permission setting that makes files world-readable. The impact is that a local user without the required privileges could access sensitive information...

CVE-2020-15387

The CVE-2020-15387 entry concerns Brocade Fabric OS hosts whose SSH servers (and SANnav) used keys

CVE-2024-29950

CVE-2024-29950 affects Brocade SANnav prior to 2.3.1 and 2.3.0a. The FileTransfer class uses the ssh-rsa signature scheme with SHA-1, enabling a remote, unauthenticated attacker to potentially perform a man-in-the-middle attack. Public disclosures from NVD, Red Hat, and Broadcom/Brocade advisorie...

CVE-2024-2240

CVE-2024-2240 refers to the Brocade SANnav Docker implementation missing audit rules. Connected advisories confirm that SANnav deployments prior to SANnav 2.3.1b run dockerd without auditing, enabling a remote authenticated attacker to perform various attacks. The published Red Hat/Broadcom SANna...

CVE-2024-29958

Brocade SANnav (SANnav) up to v2.3.0a has a vulnerability where privileged users running the script to replace the SANnav Management Portal standby node can cause the encryption key to be printed to the console. This exposes the encryption key and creates an extra attack surface for key theft. Af...

CVE-2024-29951

Brocade SANnav has CVE-2024-29951: before v2.3.1 and v2.3.0a, internal SSH ports use SHA-1 hashing, though these ports are not exposed to remote connections. The issue represents weak cryptography in internal SSH handling. Affected versions should be upgraded to SANnav 2.3.1 or later to remediate...

CVE-2019-16205

CVE-2019-16205 affects Broadcom/Brocade SANnav prior to version 2.0. The issue is a weak, insufficiently random session ID used for several post-authentication actions in the SANnav portal, enabling remote attackers to brute-force a valid session ID (session hijacking risk). Affected product: SAN...

CVE-2019-16210

Brocade SANnav vulnerable before v2.0 exposes a plain-text database connection password in logs when triggering the support save. Root cause is logging sensitive information; impact is information disclosure with high confidentiality risk. Remediation: upgrade SANnav to v2.0 or later (as noted in...

CVE-2019-16208

CVE-2019-16208 concerns Broadcom/Brocade SANnav prior to version 2.0, where the underlying password-based encryption (PBE) key-generation process is weak. This weakness may allow an attacker to decrypt passwords used by several services (e.g., Radius, TACACS) due to insufficient cryptographic str...

CVE-2020-15382

CVE-2020-15382 affects Brocade SANnav before version 2.1.1, where a hard-coded administrator account with the weak password 'passw0rd' is created if no PostgreSQL password is provided at install time. The remediation is to upgrade to SANnav 2.1.1 or apply the vendor patch per BSA-2021-1484.

CVE-2024-10405

CVE-2024-10405 affects Brocade SANnav prior to 2.3.1b. The issue enables weak TLS ciphers on ports 443 and 18082, allowing a networked attacker to read the SANnav data stream containing monitored Fabric OS switches performance data, port status, zoning information, WWNs, and IP addresses. The des...

CVE-2019-16212

CVE-2019-16212 affects Brocade SANnav prior to v2.1.0. The issue allows a remote authenticated attacker to perform an LDAP injection and bypass authentication. Remediation is to upgrade SANnav to version 2.1.0 or higher (as documented by Broadcom/Brocade advisories and Lenovo security notes). If ...

CVE-2024-29968

CVE-2024-29968 is a vulnerability in Brocade SANnav prior to 2.3.1 and 2.3.0a where, when configured in disaster recovery mode, DR standby data is collected in Supportsave. This information disclosure could allow authenticated users to access the database structure and contents (SQL table/column ...

CVE-2024-4282

CVE-2024-4282 affects Brocade SANnav OVA images prior to SANnav 2.3.1b. The issue is that the SSH port 22 configuration uses deprecated SHA-1 settings, i.e., weak TLS/cryptographic ciphers. Public materials describe this as enabling a SHA-1 deprecated setting for SSH, with the impact noting susce...

CVE-2023-31424

CVE-2023-31424 affects the Brocade SANnav Web interface. The vulnerability allows remote, unauthenticated users to bypass authentication and authorization in SANnav versions prior to 2.3.0 and prior to 2.2.2a . This could enable access to restricted functionality as described in multiple sources....

CVE-2020-15379

Brocade SANnav before v2.1.0a suffers an input validation flaw on the length of user-supplied data used as a custom field name. The issue enables remote attackers to trigger a denial-of-service via data corruption that inflates resources, causing SANnav to become unavailable until the corrupted d...

CVE-2025-4662

Brocade SANnav versions prior to 2.4.0a expose plaintext passphrases by logging them in the host server audit logs during OpenSSL command execution or when passphrases are supplied via temporary files. These audit logs are local to the server VM and not controlled by SANnav, and are only visible ...

CVE-2019-16209

The CVE-2019-16209 issue affects Broadcom/Brocade SANnav (ReportsTrustManager class) prior to version 2.0. The vulnerability enables MITM attacks by bypassing/d efficiently disabling certificate validation for SSL connections, compromising confidentiality and integrity. Root cause: improper certi...

CVE-2023-31925

CVE-2023-31925 affects Brocade SANnav prior to v2.3.0 and v2.2.2a. The issue stores SNMPv3 authentication passwords in plaintext, which could be retrieved by a privileged user via SANnav logs or the SANnav SupportSave dump after an SNMP config failure. Remediation per connected docs: upgrade to S...